feat(scripts): snapshot opentofu state before and after tofu apply #472

Sammanfogat

supernaut sammanfogade 5 incheckningar från feat/tofu-apply-snapshot in i main

2026-09-08 23:11:26 +00:00

supernaut kommenterad

2026-09-08 23:08:43 +00:00

Ägare

What

OpenTofu state is local and encrypted with no remote backend, so a bad apply had no rollback point. scripts/tofu-apply.sh wraps tofu apply:

Snapshots terraform.tfstate, its .backup and terraform.tfvars into opentofu/state-snapshots/<utc>-<sha>/ before the apply and again (-post) after it, exiting with apply's code.
Keeps the newest 20 snapshots.
Refuses to run without the state passphrase.
--restore <dir> replays a snapshot after a typed confirmation and refuses on uncommitted opentofu/*.tofu changes.
--self-test exercises snapshot, prune and restore against a temp copy.

pnpm tofu:apply now runs the wrapper. opentofu/state-snapshots/ is gitignored. No production apply is involved; the snapshots stay on the operator machine (off-site copy is #470).

Checks

scripts/tofu-apply.sh --self-test (6/6), shellcheck on the script.

## What OpenTofu state is local and encrypted with no remote backend, so a bad apply had no rollback point. `scripts/tofu-apply.sh` wraps `tofu apply`: - Snapshots `terraform.tfstate`, its `.backup` and `terraform.tfvars` into `opentofu/state-snapshots/<utc>-<sha>/` before the apply and again (`-post`) after it, exiting with apply's code. - Keeps the newest 20 snapshots. - Refuses to run without the state passphrase. - `--restore <dir>` replays a snapshot after a typed confirmation and refuses on uncommitted `opentofu/*.tofu` changes. - `--self-test` exercises snapshot, prune and restore against a temp copy. `pnpm tofu:apply` now runs the wrapper. `opentofu/state-snapshots/` is gitignored. No production apply is involved; the snapshots stay on the operator machine (off-site copy is #470). ## Checks `scripts/tofu-apply.sh --self-test` (6/6), shellcheck on the script.

supernaut lade till 5 incheckningar

2026-09-08 23:08:44 +00:00

fix(tofu): protect volumes, align defaults, tighten ci checks ed7ba075bf

fix(tofu): align the tfvars example with production volume sizes d16dd28b1a

fix(scripts): fall back to the local linter when the pinned container cannot start

ci / ci (pull_request) Successful in 1m54s

Detaljer

6b47d1dbf2

feat(scripts): snapshot opentofu state before/after tofu apply 5d7fda6465